insert里的字符串参数变量应该怎么写?

Question

请教: 
string cmdText = "insert into ChatRoom values('+strUserName+','2008-9-4 13:44:40','hi xhh')";//values()里面的'+strUserName+'是错误的,这里strUserName是一个字符串变量,应该怎么样改写?

Answer 1

string cmdText = "insert into ChatRoom values('"+strUserName+"','2008-9-4 13:44:40','hi xhh')"

Answer 2

string cmdText = "insert into ChatRoom values('"+strUserName+"','2008-9-4 13:44:40','hi xhh')";

Answer 3

string cmdText = "insert into ChatRoom values('"+strUserName+"','2008-9-4 13:44:40','hi xhh')";

Answer 4

"insert into ChatRoom values(\'"+strUserName+"\','2008-9-4 13:44:40','hi xhh')";

Answer 5

建议ChatRoom（“加上你的相应字段名”）。

Answer 6

string cmdText = "insert into ChatRoom values('"+strUserName+"','2008-9-4 13:44:40','hi xhh')";//

Answer 7

我都试过了,都不行.还是用这样好
using (SqlConnection conn = DB.crteatConn())
        {
            using (SqlCommand cmd = new SqlCommand())
            {
                cmd.Parameters.Add("@userName", SqlDbType.NVarChar, 20).Value = HiddenField1.Value;
                cmd.Parameters.Add("@DateTime", SqlDbType.NVarChar, 8).Value = DateTime.Now.ToString();
                cmd.Parameters.Add("@Message", SqlDbType.NVarChar, 150).Value = txtMessage.Text;
                cmd.CommandText = "insert into ChatRoom values(@userName,@DateTime,@Message)";
                cmd.Connection = conn;
                conn.Open();
                cmd.ExecuteNonQuery();
            }